Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell
Alert on ws_TomcatService.exe spawning cmd.exe or PowerShell on Windows as suspicious exploitation activity.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2022-01-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the parent process is ws_TomcatService.exe and the child process is cmd.exe or powershell.exe. Such behavior can indicate an attacker triggering initial execution from a vulnerable VMware Horizon component, consistent with attempts to achieve remote code execution through Log4j exposure. It relies on Windows process creation telemetry capturing ParentImage and Image paths.
Reporting behind it
- portswigger.nethttps://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
- twitter.comhttps://twitter.com/TheDFIRReport/status/1482078434327244805
- pwndefend.comhttps://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell"
id: 23f360e5-b205-4655-a413-046c1bd1f080
status: test
description: This rule flags process creation events where the parent process is ws_TomcatService.exe and the child process is cmd.exe or powershell.exe. Such behavior can indicate an attacker triggering initial execution from a vulnerable VMware Horizon component, consistent with attempts to achieve remote code execution through Log4j exposure. It relies on Windows process creation telemetry capturing ParentImage and Image paths.
references:
- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
- https://twitter.com/TheDFIRReport/status/1482078434327244805
- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-14
tags:
- attack.initial-access
- attack.t1190
- cve.2021-44228
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \ws_TomcatService.exe
filter_main_shells:
Image|endswith:
- \cmd.exe
- \powershell.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 3eb91f0a-0060-424a-a676-59f5fdd75610
type: derived